97ff2849dab3fc2a6787285310951fbb16ff4cab4b4a46fc83e5ecb14b5cbd71

Sharing

Copy URL Twitter E-mail

General

Target

97ff2849dab3fc2a6787285310951fbb16ff4cab4b4a46fc83e5ecb14b5cbd71
Size

695KB
MD5

4f17d8735382a4791058b6fd12581ce0
SHA1

4bdaabc4f5ee7661b9f1fcb9957a41ae7bf3197b
SHA256

97ff2849dab3fc2a6787285310951fbb16ff4cab4b4a46fc83e5ecb14b5cbd71
SHA512

9563da19c5c1b17bde146896fa5aa8ad85a1fa50c334a251d8bb9056ae87ca89e76b5329d375969fc6285a692dc30e77997f2caadbb7b6ae98aab7ae0f3e5234
SSDEEP

12288:uAiP79OlWKvk8YsWbbNCFqVeFi/I3t1vrhQLj/0kZnDNcs0HNNd3p9bUtD629V+:uAi790s8YsWb4KSi+ttr+EkZDOs0tvbN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97ff2849dab3fc2a6787285310951fbb16ff4cab4b4a46fc83e5ecb14b5cbd71

Files

97ff2849dab3fc2a6787285310951fbb16ff4cab4b4a46fc83e5ecb14b5cbd71
.exe windows:4 windows x86 arch:x86

bdb0cb030bcfd4cf1c0d39c87b189170

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\outlook\x86\ship\0\cnfnot32.pdb

Imports

msvcr80

?terminate@@YAXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_setmbcp
_ismbblead
abort
_expand
_msize
longjmp
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_ismbcdigit
_wcsicmp
wcschr
_mbschr
isspace
_strdup
_splitpath_s
_makepath_s
memmove
_vsnwprintf
_stricmp
_setjmp3
malloc
free
_vsnprintf
memcpy
??3@YAXPAX@Z
memset
?_type_info_dtor_internal_method@type_info@@QAEXXZ

shell32

SHGetFolderPathA

ole32

OleLoad
GetClassFile
StgCreateDocfile
OleCreateLinkToFile
OleSetContainedObject
StgOpenStorageOnILockBytes
StgIsStorageILockBytes
CoBuildVersion
CoRegisterClassObject
CoRevokeClassObject
OleSave
ReadClassStg

kernel32

InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
LoadLibraryExW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
SetLastError
GetLastError
GetCurrentProcessId
CloseHandle
GetSystemTime
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetTimeFormatW
GetDateFormatW
FileTimeToLocalFileTime
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
GetVersion
lstrcmpiA
LoadLibraryA
OutputDebugStringA
MultiByteToWideChar
GetFileAttributesA
GetFileTime
CreateFileA
DeleteFileA
WriteFile
GetTempPathA
ReadFile
SetCurrentDirectoryA
lstrlenA
CompareFileTime
WaitForSingleObject
IsBadWritePtr
IsDBCSLeadByte
GetProfileStringA
GetSystemDefaultLCID
WideCharToMultiByte
GetACP
GetCurrentThreadId
lstrlenW
FreeResource
LockResource
LoadResource
GlobalAddAtomA
GetCurrentThread
TlsSetValue
SizeofResource
FindResourceW
TlsGetValue
LocalAlloc
FindResourceA
TlsAlloc
GetVersionExA
lstrcmpA
lstrcmpW
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentDirectoryA

advapi32

RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExA
RegCloseKey

user32

GetSubMenu
GetMenu
IsWindowEnabled
GetLastActivePopup
GetForegroundWindow
RegisterClassA
CreateWindowExW
GetClassInfoA
GetClassInfoW
GetDlgCtrlID
GetTopWindow
AdjustWindowRectEx
SystemParametersInfoA
GetMonitorInfoA
MonitorFromWindow
RemovePropA
GetPropA
SetPropA
SetWindowLongW
GetWindowLongW
SetWindowsHookExA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetNextDlgTabItem
GetCursorPos
ValidateRect
GetKeyState
DispatchMessageA
TranslateMessage
GetMessageA
IsWindowVisible
MessageBoxA
TranslateAcceleratorA
GetDesktopWindow
BringWindowToTop
LoadAcceleratorsA
DestroyMenu
LoadMenuA
WinHelpA
SetMenu
EndDialog
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DialogBoxIndirectParamA
DialogBoxIndirectParamW
TabbedTextOutA
DrawTextA
GrayStringA
DrawTextW
ModifyMenuW
TabbedTextOutW
GetMenuItemID
GetClassNameA
SetWindowTextA
UnregisterClassA
UnregisterClassW
CopyRect
IsDialogMessageW
IsDialogMessageA
GetWindow
IsWindowUnicode
DefWindowProcA
CallWindowProcA
GetMessageTime
GetMessagePos
GetWindowLongA
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
LoadStringA
GetWindowTextLengthA
GetWindowTextW
GetWindowTextA
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
GetAsyncKeyState
SendDlgItemMessageA
DrawFocusRect
DrawIcon
CharPrevA
DestroyWindow
IsCharAlphaNumericA
CharNextA
GetDC
ReleaseDC
MapDialogRect
MessageBoxW
ShowWindow
LoadMenuW
GetSystemMetrics
PeekMessageA
CreateWindowExA
MessageBeep
IsWindow
SetCursor
SetForegroundWindow
GetFocus
SetWindowPos
IsIconic
SetWindowLongA
SetWindowTextW
ScreenToClient
GetDlgItem
SetFocus
EnableWindow
RedrawWindow
SendMessageA
GetClientRect
MoveWindow
GetWindowRect
OffsetRect
PostMessageA
SetRectEmpty
LoadStringW
LoadIconA
LoadCursorA
RegisterClassW
DefWindowProcW
PostQuitMessage
GetParent
GetWindowThreadProcessId
GetMenuItemCount
GetSysColor

gdi32

SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
PtVisible
DeleteDC
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetDeviceCaps
TextOutW
ExtTextOutW
PatBlt
GetTextMetricsA
CreateFontIndirectA
GetObjectA
RectVisible
GetStockObject
GetTextExtentPointW

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bdb0cb030bcfd4cf1c0d39c87b189170

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

shell32

ole32

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 103KB - Virtual size: 103KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 103KB - Virtual size: 103KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 572KB - Virtual size: 576KB